Character differentiation system generating session fingerprint using events associated with subscriber ID and session ID

ABSTRACT

A method and apparatus for character differentiation based on pattern recognition is provided. A sequence of events is received that have been generated from a given session or connection and determines if the sequence of events is likely to have come from an existing, known character, or if the events are from a previously unknown character. A character identifier (ID) is tagged onto (i.e. associated with) the event for further processing in another system that can, for example, provide different content based on the identified character and an associated preference profile.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority, under 35 U.S.C. §119(e), to U.S.Provisional Patent Application Ser. No. 61/160,919, filed on Mar. 17,2009. U.S. Provisional Patent Application Ser. No. 61/160,919 is herebyincorporated by reference in its entirety.

TECHNICAL FIELD

The present disclosure relates to on-line content delivery and inparticular to character differentiation from an on-line communicationevent stream to attribute sets of events within the streams to aparticular character to enable targeted content delivery.

BACKGROUND

With the proliferation of the use of information communicationsmechanisms such as, for example, the Internet and digital television(TV), it is desirable to be able to deliver content (e.g.advertisements) to a user of the information communications mechanismthat is particularly relevant (i.e. is targeted) to the user. In atypical household there can be multiple users (i.e. persons), usingand/or sharing multiple platforms (e.g. personal computers, differentbrowsers, media players, and set-top boxes), which share a singleconnection (e.g. Digital Subscriber Line (DSL), or cable modem) to aninformation communications mechanism (e.g. Internet Service Provider(ISP) network). Given that most users are reluctant to accept invasivedata collecting and reporting elements (e.g. agents) on their computingplatforms, differentiation of the users in a single household must beaccomplished by observing the aggregate data stream (i.e. data traffic)within the information communications mechanism (e.g. ISP network ordigital TV network).

A typical approach to attributing (i.e. associating) portions of thedata traffic to each of a plurality users for the purposes of Internetadvertising has been through the use of Hypertext Transfer Protocol(HTTP) cookies (a.k.a. Web cookies). Cookies are parcels of text sent bya server to a Web client (typically a browser) and then sent backunchanged by the client each time it accesses that server.

The use of cookies to associate data traffic with individual users has anumber of shortcomings including:

-   -   Multiple users can share the same computer, login session, or        browser and therefore will share cookies as well;    -   The same user can use multiple combinations of computers, login        sessions and browsers, each with a unique set of cookies and no        association between the sets of cookies;    -   User can delete cookies at any time resulting in the assignment        of a new cookie from a given server with no association with any        previously deleted cookie from that server; and    -   In some cases cookies associated only with particular websites        have been used resulting in associations that reflect only a        subset of the network (e.g. the Internet).

Accordingly, there is a highly desirable need for improvedidentification of characters sharing the same access point.

SUMMARY OF INVENTION

In accordance with an aspect of the present disclosure there is provideda method of character differentiation of on-line communicationsoriginating from a subscriber access point coupled to a network. Themethod comprising: receiving user generated events from one of aplurality of computing devices coupled to the access point, each eventassociated with a subscriber identification (ID) and a sessionidentification (ID), the events generated by a communication sessionbetween one of the plurality of computing devices and a communicationendpoint through the network; generating a session fingerprint using aplurality of received events for the associated subscriber ID andsession ID wherein the session fingerprint comprises a feature vectorbased upon data contained in the received events; and storing acharacter record comprising the generated fingerprint, an associatedcharacter identifier (ID) and the subscriber ID.

In accordance with an aspect of the present disclosure there is alsoprovided a character identification apparatus for characterdifferentiation of on-line communications originating from a subscriberaccess point coupled to a network. The module comprising: a processor; amemory providing instructions for execution by the processor, theinstructions for: receiving user generated events from one of aplurality of computing devices coupled to the access point, each eventassociated with a subscriber identification (ID) and a sessionidentification (ID), the events generated by a communication sessionbetween one of the plurality of computing devices and a communicationendpoint through the network; generating a session fingerprint using aplurality of received events for the associated subscriber ID andsession ID wherein the session fingerprint comprises a feature vectorbased upon data contained in the received events; and storing acharacter record comprising the generated fingerprint, an associatedcharacter identifier (ID) and the subscriber ID.

Other aspects and features of the present disclosure will becomeapparent to those ordinarily skilled in the art or science to which itpertains upon review of the following description of specificembodiments of the disclosure in conjunction with the accompanyingfigures.

BRIEF DESCRIPTION OF DRAWINGS

Further features and advantages of the present disclosure will becomeapparent from the following detailed description, taken in combinationwith the appended drawings, in which:

FIG. 1 is a schematic representation of character differentiation basedon pattern recognition;

FIG. 2 is a schematic representation of a system providing characterdifferentiation in profile selection;

FIG. 3 is a schematic representation of an apparatus for characterdifferentiation based on pattern recognition; and

FIG. 4 is a flow diagram representing a method for generating acharacter fingerprint;

FIG. 5 is a flow diagram representing a method for characterdifferentiation based on pattern recognition.

It will be noted that throughout the appended drawings, like featuresare identified by like reference numerals.

DETAILED DESCRIPTION

Embodiments are described below, by way of example only, with referenceto FIGS. 1 to 5.

A method, apparatus and system for character differentiation based onpattern recognition is provided. A sequence of events is observed thathave been generated from a given session or connection and determines ifthe sequence of events is likely to have come from an existing, knowncharacter, or if the events are from a previously unknown character. Acharacter identifier (ID) is tagged onto (i.e. associated with) theevent for further processing in another system that can, for example,provide different content based on the identified character and anassociated preference profile. Identification of a character or apersonality associated with a data stream helps in identifying potentialindividual users associated with unique browsing or interaction sessionsoriginating from a subscriber such as a household. The ability toidentify unique characters or personalities enables appropriate contentto be selected and delivered to the user by selecting an appropriatecontent preference profile. Each user may be associated with one or morecharacter identifiers based upon their browsing or content preferenceswhich may vary based upon any number of factors such as the type ofdevice being used for interaction, time of day, type of content beingaccessed, or source of content (connection endpoint). In addition, asingle character may be associated with more than one user if theirbrowsing profiles are similar.

FIG. 1 is a representation of character differentiation based on patternrecognition in a typical operating environment. Character or personalitydifferentiation can be defined in the context of a broadband datacommunication network (e.g. the Internet). Alternative it can be used inother contexts such as, for example, a digital TV distribution networkor other similar information communication mechanisms provided by anetwork service provider 150.

The service provider may be any provider such as an Internet serviceprovider (ISP) or network carrier, such as a wireless network carrier,providing a network 150 to enable subscribers to use computing device toaccess network based services. The users of an household, the subscriberto the service provider, are connected to the service provider network150 by an access point 132 provided by a modem such as for example adigital subscriber line (DSL), Data Over Cable Service InterfaceSpecification (DOCSIS), or wireless modem. The users access the networkusing networked computing devices such as Internet Protocol television(IPTV) or settop boxes 130 a, mobile devices such as laptops, notebooksor netbooks 130 b, desktop computing devices 130 c to access contentprovided by connection endpoints such as web services or content serverscoupled to the network. The service provide network 150 may providedirect access to web services provided from within the network, such aswebsites 152 or other content sources 154, or to services coupled to theInternet 160 (or other public communication network), such as website162 or content sources 164. The traffic and event filtering 110 receivesnetwork application data such as subscriber traffic 134 from subscribers130 a-130 c via access point 132 transiting network 150 and generatesweb events based upon the received traffic. The traffic may be towebsite servers 152 or content servers 154 coupled to or within theservice provider network 150 or to an external network 160 such aswebsite server 162 and content servers 164 which may be connected via anetwork such as the Internet.

The events are processed and assigned to a session originating from theaccess point 132 from a household or defined location. The filteredevents are then provided to character identification unit 115 with asession identifier. The character identification unit 115 determines thecharacter associated with the session by generating a fingerprint basedupon associated web events and assigns a character ID. A targetedcontent delivery unit 120 processes the web events and utilizes the datato generate user profiles associated with web events and the characterID to enable targeted content to be provided to the users within thehousehold.

The traffic and event filter 110 provides events from a networkconnection (e.g. a DSL line) 134 to the character identification module115. The types of events that can be identified can be specific to theinformation communication context (i.e. the application) Events caninclude page views, ad views, ad clicks or search events in the case ofInternet traffic across an ISP network. In the case of a set-top box ormedia application, events can include TV-channel-change ormedia-consumption-metadata. The events are identified by a subscriber idand by a session id that effectively provides the characteridentification module 115 with a stream of events for each concurrentsession coming from a household or subscriber connection 134. Theconnection 134 is between a location (e.g. a household), having aplurality of computing platforms and/or browsers 130 a-130 c, and anetwork infrastructure (e.g. ISP network) 150. The household id is anidentifier used to distinguish one subscriber (household) from another.The session id is assigned by the traffic and event filter.

The character identification module 115 applies algorithms to recognizepatterns in the event stream to match the stream to a known character.If a match is not found, a new character is created. To preventproliferation of characters from anomalous one-off sessions, anadditional aggregate character representing the entire event stream forthe household is maintained so that a base level of targeting may beutilized.

The pattern recognition algorithm is designed to be modular. That isthat the logic/rules applied in the algorithm can be changed and/orsupplemented. The algorithm can, for example, take into account variousfactors of the initial activities of a user's browsing session. Afingerprint can be determined for a session by considering the first ‘n’(i.e. a configurable number of) browsing events after a configurableperiod of inactivity of the connection. Additional factors that can beconsidered in the algorithm include the time-of-day or day of the weekthat the session occurs in as well as a classification of the websitesthat were visited (i.e. pages viewed). A session fingerprint isprimarily a ‘feature vector’ in which features have been selected torepresent important information that will distinguish one browsingsession from another. Features used in the case of an Internetadvertising application can include a vocabulary of words and tokensthat are commonly present in the website host names that a user browses,as well as time-of-day and major category information. In the case of aset-top box or media application, exemplary features can include channelchange events, time-of-day events or metadata information includingprogram title names, descriptions and categories (e.g. sports, movies,drama).

Multiple algorithms can be used simultaneously in a live (i.e. active)session to allow for A/B comparisons to determine the effectiveness oftuning the various parameters of the system. The comparison of multipleactive algorithms can be used to determine the most effective algorithmby determining the relative effectiveness at selecting appropriatecontent. For example, in an Internet advertising application, if onealgorithm is consistently better at presenting ads that are clicked bythe user, that algorithm is much more effective than the alternatealgorithm.

Unlike traditional systems that attempt to track individual users, thecharacter identification module 115 attempts to match charactersexhibited during a browsing or other content consumption session. In thecase of two members of a household that share similar interests andbehaviors, they will be identified as the same character for targetingpurposes. There is no personally identifiable information (PII) used inthe selection of characters.

As shown in FIG. 2, subscriber 130 household, accesses content from webserver 202 through service provider network 150. The server 202 may bemay be directly connected to network 150, such as servers 152 and 154,or may be coupled to an external network 160 such as servers 162 and 164which may be connected via a network such as the Internet. The trafficand event filtering unit 110 comprises one or more elements or devicesdeployed within the service provider network 150 or coupled to theservice provider network 150.

The elements can comprise one or more network application elements 210deployed in the service provider network. Each network application unit110 comprises at least a processor 214, memory 216 and a networkinterface (not shown), one or more data preparation and event generationelements 230 comprising at least a processor 232, memory 234 and anetwork interface (not shown). An event processor 240 comprising atleast a processor 242, memory 244 and a network interface (not shown)provides filtered web events to a character identification unit 115,comprising at least a processor 262 and memory 264 and a networkinterface (not shown). The character identification unit 115 may alsoprovide storage 266 for the determine characters. Once a characterfingerprint has been assigned, the web event and the determinedcharacter identifier are provided to the profiler 270 comprising atleast a processor 272, memory 274 and a network interface (not shown).The profiler 270 maintains user preference profile associated with eachdetermine character with may be provided in storage 276 for retrieval asrequired. A content server 280 comprising at least a processor 282,memory 284 and a network interface (not shown), retrieves profileinformation from the profiler and selects appropriate content for theprofile to be delivered to the end user. Although the networkapplication unit 110 and the targeted content delivery unit 120 aredescribed as comprising individual elements and/or units each beingexecuted by individual processors and memory, the functionality of thenetwork application unit 110 and the targeted content delivery unit mayeach be consolidated and executed on a single processor or computingplatform depending on network topology. Similarly, the functionality maybe distributed across multiple computing platforms as required.

The network application unit 110 supports capturing and processing ofnetwork application data, web traffic or web activities, between thesubscriber 120 and the web server 202. The term ‘web’ refers to theaccessing network accessible data comprising content such as text,images, videos, and other multimedia using hyperlinks The networkapplication element 210 also supports exporting or allows externalaccess of these web traffic activities. Web traffic is typicallyhypertext transfer protocol (HTTP)-based traffic that uses transmissioncontrol part (TCP) port 80. Web activities are summarized web trafficthat can, for example, include: website visit, video download,e-Commerce interaction on website, search performed, and other similarInternet activities. A network application unit 110 can comprise one ormore types of network application elements 210 based upon theintegration within the service provider network. The network applicationelements may be incorporated in the communication path between theaccess point and communication end point or adjunct to the communicationpath where copies or duplicates of the events are forwarded to thenetwork application element from a device within the communication path.

Each data preparation and event generation element 230 provides forinterfacing with one or more of network application elements 210 (ofvarious types) and is responsible for accessing the network applicationdata such as web traffic or web activities that are alternativelyforwarded or logged by the network application elements 210. Afterreceiving the web traffic or web activities, the data preparation andevent generation element 210 is responsible for eliminating unnecessarydata (e.g. removing the content portion of HTTP web traffic, removingthe content portion of a web based video stream, etc.) and ultimatelyformulating the web traffic/activities into well-defined web events fordown stream processing. Examples of web events are search events,website visit events, advertisement (ad) click events, e-Commerceinteraction events, online video selection events, and other similarevents. These events, accompanied by a subscriber identifier (ID) suchas, for example, an Internet Protocol (IP) address associated with thesubscriber household 130, are sent to targeted content delivery unit 120for processing.

The event processor 240 provides for collecting and aggregating eventsfrom the data preparation and event generation elements 230. The networkapplication data such as web events are further filtered (e.g. byeliminating any personal or sensitive information). The events and theassociated session ID are processed by the character identification unit115. The character identification unit 115 determines a fingerprint forthe session and determines a character identifier 266 for the session,as described in connection with FIG. 4, and forwards the web events,subscriber identifier and character identifier to the profiler 270 forfurther processing.

The profiler 270 is a real-time component within the targeted contentdelivery unit 120. The profiler 270 takes each filtered web event,subscriber ID and character ID, from the event processor 240 as inputand generates or updates stored profiles 276 using the one or moreprofiling algorithms. The profile can be related to character interestswithin the subscriber household. The profiler 270 operates in real-timeand the generated profiles are made available to the content server 280.

The content server 280, upon receiving a request for targeted content(e.g. an advertisement, a video clip, a music file, etc.) from a contentuser, queries the profiler 270 for profile information related to thecontent user; and/or profile information related to the context of therequest (e.g. this might include the context of the content provider,publisher, genre of the requested content, etc.). The content server 280can request, from the profiler 270, profile information generated usingone or more profile modelling algorithms. Based on the received profileinformation, the most appropriate piece of content is selected andserved to the content user. The selection criteria can be based onrelevancy to the user, revenue-generating ability, or other businessrules related to the content user or the targeted content. The contentserver 280 can choose to use profile information generated usingdifferent profile modelling algorithms on successive targeted contentrequests in order to conduct A/B testing (i.e. alternative comparison)to optimize performance on an ongoing basis.

FIG. 3 is a schematic representation of the character identificationmodule 115 for character or personality differentiation based on patternrecognition. The character identification module 115 comprises an eventreceiver 310, an event collector 320, a character calculator 330, amatching engine 340, a repository of matching algorithms 350, acharacter creator/updater 360 and a character repository 370. The eventreceiver 310 receives event traffic and extracts a household ID and asession ID. The event collector 320 provides for events to be storeduntil there are a sufficient number for processing. The charactercalculator 330 provides for generating a character fingerprint based ona plurality of events occurring in a session. The matching engine 340provides for matching a candidate character with one of a plurality ofknown characters. Matching is based on matching algorithms provided bythe matching algorithm repository 350. The character creator/updater 360provides for creating a new character and for updating the fingerprintof an existing character. A plurality of characters can be stored in andretrieved from the character repository 370 which may be coupled to anexternal storage repository 266.

The method according to the present disclosure can be implemented usingthe character identification module 115 described above with referenceto FIGS. 1 to 3. Alternatively, the method according to the presentdisclosure can be implemented using computer executable programinstructions stored on a computer-readable storage memory.

FIG. 4 is a flow diagram representing a method 400 for character orpersonality differentiation based on pattern recognition. The generatedevents are received at 402 from one of a plurality of computers, in ahousehold, connected to an access point. Each event is associated with asubscriber identification (ID) and a session identification (ID) andgenerated by with a communication session between one of the pluralityof computing devices and a communication endpoint, such as a web serveror content through, the network. At 404 a session fingerprint isgenerated using a plurality of received events for the associatedsubscriber ID and session ID. The session fingerprint comprises afeature vector based upon data contained in the received events. Acharacter record is then stored at 406, the record comprises thegenerated fingerprint, an associated character identifier (ID) and thesubscriber ID.

FIG. 5 is a flow diagram representing a method 500 for character orpersonality differentiation based on pattern recognition. An event isreceived at 502, the event is associated with a household ID (orsubscriber ID) and a session ID. The session ID is assigned by thetraffic and event filtering 110 based upon OS fingerprinting and sessiondetection techniques. The session ID is also based upon a defined periodof usages where periods of inactivity restart a session.

For each incoming event, a check is made at 504 to determine if thesession has already been assigned a character. When the session ID hasalready been assigned to a character, YES at 504, a determination ismade as to whether the session has recently been active at 506. When thesession has been active, YES at 506, the event is assigned to thecharacter associated with the session at 508 and the event is forwardedto the content delivery unit 120 to determine an associate profile.Determination of session activity may be based upon a defined timeinterval, such as 15 minutes, in which associated events must bereceived to maintain session as active.

When there has been no recent activity on the session, NO at 506, eventsare collected at 510. A determination is made as to whether enoughevents have been received to perform the pattern-matching algorithm.Until enough events have been received to assign a character, NO at 512,each event is assigned to an aggregate household character at 514.

Once the required events have been collected, YES at 512, the sessioncharacter fingerprint is calculated at 516. Each character fingerprintis represented as a feature vector that represents the attributes of theinitial portions of a browsing session. The fingerprint is comprised oftokens from a vocabulary list based on, for example, the first 5 (thiscan be tuned) events of a web browsing session. Specifically the hostname from the web event is broken down into tokens. These tokens formthe feature vector that represent a term associated with a host name anda weight defining the occurrence of the term in collected events. Byadding together the feature vectors for each of the five events, afeature vector that represents the fingerprint of the session isgenerated. A sample fingerprint is shown in Table 2.

The calculated character is compared with existing known characters at518 for the household. The matching algorithm is not absolute (i.e. aperfect match is not necessary to conclude that it is the samecharacter). The initial matching algorithm utilized is an application ofan adaptation of well known natural language processing.

Multiple feature vectors can be compared for similarity using atechnique such as cosine similarity. The matching algorithm, such ascosine similarity, comprises a calculation to determine the anglebetween two vectors. Cosine similarity is known approach in text miningand data mining. It measures the similarity between two vectors of equaldimensions by looking at the cosine of the angle between them. Theoutput of the algorithm is a score between 0 and 1. When the anglebetween the session fingerprint and the character fingerprint is small,the sessions are considered to be matched. The threshold used todetermine that two sessions are matched can be tuned and configured toachieve a desire level of matching.

If similarity between the best match and the current session is above acertain threshold (for example 0.5), then that character is chosen, YESat 518, all events from that session are assigned to the known characterat 520 and the fingerprint is updated at 522. If there is an existingcharacter fingerprint and the current session's character fingerprintare averaged, and the existing character is updated (i.e. replaced) witha result of the averaging. This means that characters are continuallylearning to incorporate small differences in the initial characterfingerprint.

When an appropriate match cannot be found within the existingcharacters, NO at 518, a new character is created that reflects the newinitial browsing behavior that has been observed at 524. A limit can bedefined as to how many characters can be defined for a household as wellas an aging process that is used to remove characters that have notrecently being observed from the household and replaced by the newcharacter. The character associated with the session and the event isforwarded to the content delivery unit 120.

The character data structure may be defined in a record such as in Table1.

TABLE 1 Character structure Household ID <INTEGER> Character ID<INTEGER> Last Activity Time <TIMESTAMP> Fingerprint <RECORD>

The household ID may be based upon any number of identifiers such as IPaddress, radius client; user logon identifier or any static dataassociated with the household access point The character ID is anidentifier to uniquely identify the character. An activity time stampidentifying the last update or creation of the character. Each characterhas an associated fingerprint as shown in Table 2.

TABLE 2 Fingerprint structure Index Weight 75 1 132 2 198 1 345 1 364 4

The fingerprint represents a session with 5 unique tokens, with a totalof 9 occurrences between them. The feature vector is sparsely stored.Any indices for which the corresponding token did not occur, is simplynot stored. The index maps to a source index of terms found in orassociated with event metadata or terms identified in the UniversalResource Locator (URL) of the event.

It will be apparent to one skilled in the art that numerousmodifications and departures from the specific embodiments describedherein may be made without departing from the spirit and scope of thepresent disclosure.

The invention claimed is:
 1. A method of character differentiation ofon-line communications originating from a subscriber access pointcoupled to a network, the method comprising: receiving user generatedevents from one of a plurality of computing devices coupled to theaccess point, each event associated with a subscriber identification(ID) and a session identification (ID), the events generated by acommunication session between one of the plurality of computing devicesand a communication endpoint through the network; generating a sessionfingerprint using a plurality of received events for the associatedsubscriber ID and session ID wherein the session fingerprint comprises afeature vector based upon data contained in the received events; andstoring a character record comprising the generated fingerprint, anassociated character identifier (ID) and the subscriber ID.
 2. Themethod of claim 1 wherein the feature vector comprises tokens, eachtoken indexed to a term defined in vocabulary list, the tokensdetermined based upon communication endpoint location informationprovided by the received events.
 3. The method of claim 2 wherein eachtoken further comprises a weight associated with token defined in thefeature vector, the weight defining the relative occurrence of the tokenin the received events.
 4. The method of claim 3 wherein the tokens aredefined by host names identified in the event, the tokens form thevector that represent the host name.
 5. The method of claim 2 whereinthe feature vector features selected form the list comprising: a channelchange events, time-of-day events, and metadata information includingprogram title names, descriptions and categories.
 6. The method of claim1 wherein the features include a vocabulary of words commonly present inwebsite host names, as well as time-of-day and major categoryinformation.
 7. The method of claim 1 further comprising determining ifthe character record is active within a defined time interval, whereinif character record is active, the character record is updated with thereceived events.
 8. The method of claim 1 wherein prior to storing thecharacter record, the method further comprising comparing the sessionfingerprint to one or more stored fingerprints, each associated with acharacter record sharing a common subscriber ID, to determine if acharacter fingerprint has already been identified.
 9. The method ofclaim 8 wherein comparing the fingerprints is performed by a matchingalgorithm to provide a similarity indicator between the determinedfingerprint and the stored fingerprints, the matching algorithmproviding a value between 0 and
 1. 10. The method of claim 9 wherein ifthe similarity is greater than 0.5 a match is declared and the featurevectors are updated based upon the received events.
 11. The method ofclaim 10 wherein the matching algorithm is a cosine similarityalgorithm.
 12. The method of claim 1 determining if the received eventsare associated with an existing active session is further defined basedupon an active time interval in which associated events must be receivedto maintain character record as active.
 13. The method of claim 1wherein the comparing the fingerprint further comprises comparing atime-of-day or day of the week associated with the character record. 14.The method of claim 13 further comprising comparing a classification ofwebsites that were visited.
 15. The method of claim 1 wherein the eventsdefine a HTTP request portion between the computing device andcommunication endpoint.
 16. The method of claim 1 wherein the session IDis assigned by OS fingerprinting technique to distinguish activecommunication sessions originating from the same access point.
 17. Themethod of claim 1 wherein the access point is selected from the groupcomprising: a digital subscriber line modem; a Data Over Cable ServiceInterface Specification (DOCSIS), and a wireless modem.
 18. The methodof claim 1 wherein the character ID, subscriber identifier and receivedevents are used to determine an associated content preference profileused from determining applicable content to be provided to a userassociated with the session based upon user content preferences.
 19. Acharacter identification apparatus for character differentiation ofon-line communications originating from a subscriber access pointcoupled to a network, the module comprising: a processor; a memoryproviding instructions for execution by the processor, the instructionsfor: receiving user generated events from one of a plurality ofcomputing devices coupled to the access point, each event associatedwith a subscriber identification (ID) and a session identification (ID),the events generated by a communication session between one of theplurality of computing devices and a communication endpoint through thenetwork; generating a session fingerprint using a plurality of receivedevents for the associated subscriber ID and session ID wherein thesession fingerprint comprises a feature vector based upon data containedin the received events; and storing a character record comprising thegenerated fingerprint, an associated character identifier (ID) and thesubscriber ID.
 20. A computer readable memory storing instructions forexecution by a processor, the instructions for performing characterdifferentiation of on-line communications originating from a subscriberaccess point coupled to a network, the instructions comprising:receiving user generated events from one of a plurality of computingdevices coupled to the access point, each event associated with asubscriber identification (ID) and a session identification (ID), theevents generated by a communication session between one of the pluralityof computing devices and a communication endpoint through the network;generating a session fingerprint using a plurality of received eventsfor the associated subscriber ID and session ID wherein the sessionfingerprint comprises a feature vector based upon data contained in thereceived events; and storing a character record comprising the generatedfingerprint, an associated character identifier (ID) and the subscriberID.